A vulnerability, which was classified as critical, was found in Rapid7 InsightCloudSec up to 23.2.0 (Cloud Software). Affected is the function getattr of the component Jinja Template Handler. The manipulation with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

The weakness was presented 03/22/2023. The advisory is available at nephosec.com. This vulnerability is traded as CVE-2023-1304 since 03/09/2023. Technical details and a public exploit are known. This vulnerability is assigned to T1059 by the MITRE ATT&CK project.

The exploit is shared for download at nephosec.com. It is declared as proof-of-concept.

Upgrading to version 23.2.1 eliminates this vulnerability. The upgrade is hosted for download at docs.divvycloud.com.

Productinfo

Type

• Cloud Software

Vendor

• Rapid7

Name

• InsightCloudSec

Version

• 23.0
• 23.1
• 23.2

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion